set -uo pipefail

OID="${1:?outbox id}"; OUT="${2:?outbox path}"

[ "${PM_APPROVED:-0}" = "1" ] || { echo "refuse: not an approved flush"; exit 2; }

PAYLOAD=$(jq -r --arg id "$OID" '.history[] | select(.id==$id) | .preview' "$OUT")

field(){ printf '%s\n' "$PAYLOAD" | sed -n "s/^$1:[[:space:]]*//p" | head -1; }

FROM=$(field FROM); PWVAR=$(field PWVAR); TO=$(field TO); SUBJECT=$(field SUBJECT)

BODY=$(printf '%s\n' "$PAYLOAD" | sed -n '/^BODY:/,$p' | tail -n +2)

[ -z "$FROM" ] || [ -z "$PWVAR" ] || [ -z "$TO" ] && {

  echo "execute-email: missing FROM/PWVAR/TO in draft $OID. Left for manual."; exit 3; }

source <(tr -d '\r' < /shared/projects/.env.secrets) 2>/dev/null

APP_PW="${!PWVAR:-}"

[ -z "$APP_PW" ] && { echo "execute-email: $PWVAR not set in .env.secrets (generate Gmail app password). Left for manual."; exit 3; }

echo "[pm] sending as $FROM -> $TO  (subj: $SUBJECT)"

printf 'From: %s\r\nTo: %s\r\nSubject: %s\r\nMIME-Version: 1.0\r\nContent-Type: text/plain; charset=UTF-8\r\n\r\n%s\r\n' \

  "$FROM" "$TO" "$SUBJECT" "$BODY" \

  | curl -s --ssl-reqd --url "smtps://smtp.gmail.com:465" \

         --user "$FROM:$APP_PW" --mail-from "$FROM" --mail-rcpt "$TO" --upload-file - \

  && { echo "[pm] sent ok"; exit 0; } \

  || { echo "[pm] send FAILED (check app password / Gmail security)"; exit 1; }